chore: sync with basecamp/kamal-proxy main (on-demand TLS, client-IP header, Go 1.26.5)

Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.26.4 AS build
+FROM golang:1.26.5 AS build
 
 WORKDIR /app
 

README.md

@@ -119,6 +119,29 @@ the original path (including the prefix), specify `--strip-path-prefix=false`:
     kamal-proxy deploy service1 --target web-1:3000 --path-prefix=/api --strip-path-prefix=false
 
 
+### Excluding paths from metrics
+
+When metrics are enabled (with `--metrics-port`), every request handled by
+the proxy is recorded in the Prometheus output. High-volume traffic from
+upstream load balancers or uptime monitors hitting health endpoints can
+both inflate the metrics pipeline and dominate aggregate measures like
+request rate, latency percentiles, and error rates, making the resulting
+metrics a poor reflection of real user traffic.
+
+To exclude one or more paths from the metrics for a service, use
+`--exclude-metrics-path` when deploying. The flag may be repeated, and
+matches are exact:
+
+    kamal-proxy deploy service1 --target web-1:3000 --exclude-metrics-path /up --exclude-metrics-path /healthz
+
+Excluded requests are still logged; only the Prometheus counters and
+in-flight gauge are skipped.
+
+Paths are specified as the upstream receives them. Services deployed using
+stripped path prefixes should specify their excluded paths in the un-prefixed
+form.
+
+
 ### Automatic TLS
 
 Kamal Proxy can automatically obtain and renew TLS certificates for your
@@ -134,6 +157,33 @@ root path. Services deployed to other paths on the same host will use the same
 TLS settings as those specified for the root path.
 
 
+### On-demand TLS
+
+Instead of specifying a static list of hosts, Kamal Proxy can also obtain TLS
+certificates dynamically, for any host approved by an HTTP endpoint of your
+choice. This is useful when the full set of hosts is not known at deploy time,
+such as when serving customer domains.
+
+To enable this, specify `--tls-on-demand-url` (instead of `--host`) when
+deploying:
+
+    kamal-proxy deploy service1 --target web-1:3000 --tls --tls-on-demand-url="http://localhost:4567/check"
+
+The URL may be:
+
+- An external URL (like `http://localhost:4567/check`), which Kamal Proxy will
+  call directly, or
+- A path (like `/check`), which Kamal Proxy will route through the service to
+  your application, letting the application decide which hosts to allow.
+
+Before issuing a certificate for a host, Kamal Proxy will send a `GET` request
+to the endpoint, with the hostname in a `host` query parameter (for example,
+`?host=app1.example.com`) and matching `Host` header. A `200` response allows
+certificate issuance; any other response denies it, and the status code and up
+to 256 bytes of the response body are logged to help with debugging. Checks
+time out after 2 seconds, denying issuance for that attempt.
+
+
 ### Custom TLS certificate
 
 When you obtained your TLS certificate manually, manage your own certificate authority,

example/upstream/Dockerfile

@@ -1,4 +1,4 @@
-from golang:1.26.4 as build
+from golang:1.26.5 as build
 workdir /app
 copy . .
 env CGO_ENABLED=0

go.mod

@@ -1,6 +1,6 @@
 module github.com/basecamp/kamal-proxy
 
-go 1.26.4
+go 1.26.5
 
 require (
 	github.com/coder/websocket v1.8.12
@@ -10,9 +10,9 @@ require (
 	github.com/quic-go/quic-go v0.60.0
 	github.com/spf13/cobra v1.10.2
 	github.com/stretchr/testify v1.11.1
-	golang.org/x/crypto v0.53.0
-	golang.org/x/net v0.56.0
-	golang.org/x/sys v0.46.0
+	golang.org/x/crypto v0.54.0
+	golang.org/x/net v0.57.0
+	golang.org/x/sys v0.47.0
 )
 
 require (
@@ -53,8 +53,8 @@ require (
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
-	github.com/prometheus/common v0.69.0 // indirect
-	github.com/prometheus/procfs v0.20.1 // indirect
+	github.com/prometheus/common v0.70.0 // indirect
+	github.com/prometheus/procfs v0.21.1 // indirect
 	github.com/quic-go/qpack v0.6.0 // indirect
 	github.com/spf13/pflag v1.0.10 // indirect
 	github.com/vultr/govultr/v3 v3.26.0 // indirect
@@ -63,11 +63,11 @@ require (
 	go.opentelemetry.io/otel v1.38.0 // indirect
 	go.opentelemetry.io/otel/metric v1.38.0 // indirect
 	go.opentelemetry.io/otel/trace v1.38.0 // indirect
-	golang.org/x/mod v0.36.0 // indirect
+	golang.org/x/mod v0.37.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
-	golang.org/x/sync v0.21.0 // indirect
-	golang.org/x/text v0.38.0 // indirect
-	golang.org/x/tools v0.45.0 // indirect
+	golang.org/x/sync v0.22.0 // indirect
+	golang.org/x/text v0.40.0 // indirect
+	golang.org/x/tools v0.47.0 // indirect
 	google.golang.org/api v0.257.0 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20251124214823-79d6a2a48846 // indirect
 	google.golang.org/grpc v1.77.0 // indirect

go.sum

@@ -103,10 +103,10 @@ github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h
 github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg=
 github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
 github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
-github.com/prometheus/common v0.69.0 h1:OA85nJQS/T/MaYh/Q2CcgDKSGWqNIgrBDvDH85CuiNk=
-github.com/prometheus/common v0.69.0/go.mod h1:ZzL3f6u94qUxh9p+tJTrF+FvBS1XXbbRAZCQkytAL0Y=
-github.com/prometheus/procfs v0.20.1 h1:XwbrGOIplXW/AU3YhIhLODXMJYyC1isLFfYCsTEycfc=
-github.com/prometheus/procfs v0.20.1/go.mod h1:o9EMBZGRyvDrSPH1RqdxhojkuXstoe4UlK79eF5TGGo=
+github.com/prometheus/common v0.70.0 h1:bcpru3tWPVnxGnETLgOV5jbp/JRXgYEyv65CuBLAMMI=
+github.com/prometheus/common v0.70.0/go.mod h1:S/SFasQmgGiYH6C81LKCtYa8QACgthGg5zxL2udV7SY=
+github.com/prometheus/procfs v0.21.1 h1:GljZCt+zSTS+NZq88cyQ1LjZ+RCHp3uVuabBWA5+OJI=
+github.com/prometheus/procfs v0.21.1/go.mod h1:aB55Cww9pdSJVHk0hUf0inxWyyjPogFIjmHKYgMKmtY=
 github.com/quic-go/go-ossfuzz-seeds v0.1.0 h1:APacT+iIaNF6fd8AGEiN3bT/Jtkd2jz4v4TzM7MFjy0=
 github.com/quic-go/go-ossfuzz-seeds v0.1.0/go.mod h1:3IOHRbJIc+L6YKMwfDtJAM9Vj9k0YY4muhuyUYk5tbk=
 github.com/quic-go/qpack v0.6.0 h1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=
@@ -148,24 +148,24 @@ go.uber.org/mock v0.5.2/go.mod h1:wLlUxC2vVTPTaE3UD51E0BGOAElKrILxhVSDYQLld5o=
 go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
 go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
-golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=
-golang.org/x/mod v0.36.0 h1:JJjpVx6myfUsUdAzZuOSTTmRE0PfZeNWzzvKrP7amb4=
-golang.org/x/mod v0.36.0/go.mod h1:moc6ELqsWcOw5Ef3xVprK5ul/MvtVvkIXLziUOICjUQ=
-golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
-golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
+golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
+golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
+golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
+golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
+golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
+golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
-golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
-golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
-golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=
-golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
+golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
 golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
 golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
-golang.org/x/tools v0.45.0 h1:18qN3FAooORvApf5XjCXgsuayZOEtXf6JK18I3+ONa8=
-golang.org/x/tools v0.45.0/go.mod h1:LuUGqqaXcXMEFEruIVJVm5mgDD8vww/z/SR1gQ4uE/0=
+golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
+golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
 gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=

internal/cmd/deploy.go

@@ -36,6 +36,7 @@ func newDeployCommand() *deployCommand {
 	deployCommand.cmd.Flags().BoolVar(&deployCommand.args.ServiceOptions.StripPrefix, "strip-path-prefix", true, "With --path-prefix, strip prefix from request before forwarding")
 
 	deployCommand.cmd.Flags().BoolVar(&deployCommand.args.ServiceOptions.TLSEnabled, "tls", false, "Configure TLS for this target (requires a non-empty host)")
+	deployCommand.cmd.Flags().StringVar(&deployCommand.args.ServiceOptions.TLSOnDemandURL, "tls-on-demand-url", "", "Will make an HTTP request to the given URL, asking whether a host is allowed to have a certificate issued")
 	deployCommand.cmd.Flags().BoolVar(&deployCommand.tlsStaging, "tls-staging", false, "Use Let's Encrypt staging environment for certificate provisioning")
 	deployCommand.cmd.Flags().StringVar(&deployCommand.args.ServiceOptions.TLSCertificatePath, "tls-certificate-path", "", "Configure custom TLS certificate path (PEM format)")
 	deployCommand.cmd.Flags().StringVar(&deployCommand.args.ServiceOptions.TLSPrivateKeyPath, "tls-private-key-path", "", "Configure custom TLS private key path (PEM format)")
@@ -71,7 +72,9 @@ func newDeployCommand() *deployCommand {
 
 	deployCommand.cmd.Flags().StringSliceVar(&deployCommand.args.TargetOptions.LogRequestHeaders, "log-request-header", nil, "Additional request header to log (may be specified multiple times)")
 	deployCommand.cmd.Flags().StringSliceVar(&deployCommand.args.TargetOptions.LogResponseHeaders, "log-response-header", nil, "Additional response header to log (may be specified multiple times)")
+	deployCommand.cmd.Flags().StringSliceVar(&deployCommand.args.ServiceOptions.ExcludeMetricsPaths, "exclude-metrics-path", nil, "Request path(s) to exclude from Prometheus metrics (may be specified multiple times)")
 	deployCommand.cmd.Flags().BoolVar(&deployCommand.args.TargetOptions.ForwardHeaders, "forward-headers", false, "Forward X-Forwarded headers to target (default false if TLS enabled; otherwise true)")
+	deployCommand.cmd.Flags().StringVar(&deployCommand.args.ServiceOptions.ClientIPHeader, "client-ip-header", "", "Request header containing the original client IP; used to populate X-Forwarded-For when present")
 	deployCommand.cmd.Flags().BoolVar(&deployCommand.args.TargetOptions.ScopeCookiePaths, "scope-cookie-paths", false, "Scope cookie paths to match path prefix")
 
 	deployCommand.cmd.MarkFlagRequired("target")

internal/cmd/deploy_test.go

@@ -112,6 +112,37 @@ func TestDeployCommand_PathTimeoutParsing(t *testing.T) {
 	}
 }
 
+func TestDeployCommand_TLSOnDemandURL(t *testing.T) {
+	t.Run("host is not required when a TLS on-demand URL is set", func(t *testing.T) {
+		cmd := newDeployCommand()
+		cmd.args.ServiceOptions.TLSEnabled = true
+		cmd.args.ServiceOptions.TLSOnDemandURL = "https://example.com/allow-host"
+
+		require.NoError(t, cmd.preRun(cmd.cmd, []string{"test-service"}))
+	})
+
+	t.Run("hosts cannot be combined with a TLS on-demand URL", func(t *testing.T) {
+		cmd := newDeployCommand()
+		cmd.args.ServiceOptions.TLSEnabled = true
+		cmd.args.ServiceOptions.TLSOnDemandURL = "https://example.com/allow-host"
+		cmd.args.ServiceOptions.Hosts = []string{"example.com"}
+
+		err := cmd.preRun(cmd.cmd, []string{"test-service"})
+		require.ErrorContains(t, err, "cannot set hosts when using a TLS on-demand URL")
+		require.ErrorIs(t, err, server.ErrServiceOptionsInvalid)
+	})
+
+	t.Run("the TLS on-demand URL must be valid", func(t *testing.T) {
+		cmd := newDeployCommand()
+		cmd.args.ServiceOptions.TLSEnabled = true
+		cmd.args.ServiceOptions.TLSOnDemandURL = "ftp://example.com/allow-host"
+
+		err := cmd.preRun(cmd.cmd, []string{"test-service"})
+		require.ErrorContains(t, err, "unsupported scheme")
+		require.ErrorIs(t, err, server.ErrServiceOptionsInvalid)
+	})
+}
+
 func TestDeployCommand_CanonicalHostValidation(t *testing.T) {
 	tests := []struct {
 		name          string

internal/server/client_ip_middleware.go

@@ -0,0 +1,24 @@
+package server
+
+import (
+	"net/http"
+)
+
+type ClientIPMiddleware struct {
+	headerName string
+	next       http.Handler
+}
+
+func WithClientIPMiddleware(headerName string, next http.Handler) http.Handler {
+	return &ClientIPMiddleware{
+		headerName: http.CanonicalHeaderKey(headerName),
+		next:       next,
+	}
+}
+
+func (h *ClientIPMiddleware) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	if clientIP := r.Header.Get(h.headerName); clientIP != "" {
+		r.Header.Set("X-Forwarded-For", clientIP)
+	}
+	h.next.ServeHTTP(w, r)
+}

internal/server/logging_middleware.go

@@ -22,6 +22,7 @@ type loggingRequestContext struct {
 	Target          string
 	RequestHeaders  []string
 	ResponseHeaders []string
+	ExcludeMetrics  bool
 }
 
 type LoggingMiddleware struct {
@@ -105,7 +106,9 @@ func (h *LoggingMiddleware) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		attrs = append(attrs, h.retrieveCustomHeaders(loggingRequestContext.ResponseHeaders, writer.Header(), "resp")...)
 		h.logger.LogAttrs(context.Background(), slog.LevelInfo, "Request", attrs...)
 
-		metrics.Tracker.TrackRequest(loggingRequestContext.Service, r.Method, writer.statusCode, elapsed)
+		if !loggingRequestContext.ExcludeMetrics {
+			metrics.Tracker.TrackRequest(loggingRequestContext.Service, r.Method, writer.statusCode, elapsed)
+		}
 	}()
 
 	h.next.ServeHTTP(writer, r)

internal/server/logging_middleware_test.go

@@ -98,3 +98,26 @@ func TestMiddleware_LoggingMiddleware(t *testing.T) {
 	assert.Equal(t, "HTTP/1.1", logline.Proto)
 	assert.Equal(t, "http", logline.Scheme)
 }
+
+func TestMiddleware_LoggingMiddlewareLogsClientIPHeaderAsRemoteAddr(t *testing.T) {
+	out := &strings.Builder{}
+	logger := slog.New(slog.NewJSONHandler(out, nil))
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {})
+
+	middleware := WithLoggingMiddleware(logger, 80, 443, WithClientIPMiddleware("True-Client-IP", handler))
+
+	req := httptest.NewRequest("GET", "http://app.example.com/", nil)
+	req.Header.Set("X-Forwarded-For", "10.10.10.10")
+	req.Header.Set("True-Client-IP", "203.0.113.7")
+
+	middleware.ServeHTTP(httptest.NewRecorder(), req)
+
+	logline := struct {
+		RemoteAddr string `json:"remote_addr"`
+	}{}
+
+	err := json.NewDecoder(strings.NewReader(out.String())).Decode(&logline)
+	require.NoError(t, err)
+
+	assert.Equal(t, "203.0.113.7", logline.RemoteAddr)
+}

internal/server/path_timeouts.go

@@ -46,10 +46,16 @@ func NormalizePathTimeouts(pathTimeouts []PathTimeout) []PathTimeout {
 // pathTimeouts must already be normalized.
 func ResolvePathTimeout(path string, pathTimeouts []PathTimeout, fallback time.Duration) time.Duration {
 	for _, pathTimeout := range pathTimeouts {
-		if strings.HasPrefix(EnsureTrailingSlash(path), EnsureTrailingSlash(pathTimeout.PathPrefix)) {
+		if PathMatchesPrefix(path, pathTimeout.PathPrefix) {
 			return pathTimeout.Timeout
 		}
 	}
 
 	return fallback
 }
+
+// PathMatchesPrefix reports whether path falls below pathPrefix, matching on
+// whole segments the same way service path prefixes do.
+func PathMatchesPrefix(path, pathPrefix string) bool {
+	return strings.HasPrefix(EnsureTrailingSlash(path), EnsureTrailingSlash(pathPrefix))
+}

internal/server/router.go

@@ -37,6 +37,17 @@ func RoutingContext(r *http.Request) *routingContext {
 	return rc
 }
 
+func RoutedTargetPath(r *http.Request) string {
+	path := r.URL.Path
+	if rc := RoutingContext(r); rc != nil {
+		path = strings.TrimPrefix(path, rc.MatchedPrefix)
+		if path == "" {
+			path = rootPath
+		}
+	}
+	return path
+}
+
 type Router struct {
 	statePath            string
 	services             *ServiceMap